crowdsecurity/crowdsec · error

SQS message format not supported

Error message

SQS message format not supported

What it means

Terminal failure in extractBucketAndPrefix (called by sqsPoll): the SQS message matched none of the three supported envelope formats — EventBridge, raw S3 notification, or SNS-wrapped S3 notification — each attempt returning an error. This is a fallback chain exhausted: the message on the queue is in an unrecognized format and cannot be mapped to a bucket/object to fetch.

Source

Thrown at pkg/acquisition/modules/s3/run.go:260

		bucket, key, err := extractBucketAndPrefixFromEventBridge(message)
		if err == nil {
			s.Config.SQSFormat = SQSFormatEventBridge
			return bucket, key, nil
		}

		bucket, key, err = extractBucketAndPrefixFromS3Notif(message)
		if err == nil {
			s.Config.SQSFormat = SQSFormatS3Notification
			return bucket, key, nil
		}

		bucket, key, err = extractBucketAndPrefixFromSNSNotif(message)
		if err == nil {
			s.Config.SQSFormat = SQSFormatSNS
			return bucket, key, nil
		}

		return "", "", errors.New("SQS message format not supported")
	}
}

func (s *Source) sqsPoll() error {
	logger := s.logger.WithField("method", "sqsPoll")

	for {
		select {
		case <-s.t.Dying():
			logger.Infof("Shutting down SQS poller")
			s.cancel()
			return nil
		default:
			logger.Trace("Polling SQS queue")

			out, err := s.sqsClient.ReceiveMessage(s.ctx, &sqs.ReceiveMessageInput{
				QueueUrl:            aws.String(s.Config.SQSName),
				MaxNumberOfMessages: 10,

View on GitHub (pinned to 909b515798)

Solutions

1. Dump the offending SQS message body and compare it with the three supported schemas
2. Route only S3/EventBridge/SNS S3-notifications to this queue; other producers are unsupported
3. After a format is first detected, SQSFormat pins it so later messages parse directly — fix the producer so the first message is well-formed

When it happens

Trigger: Thrown at pkg/acquisition/modules/s3/run.go:260 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/88919b3ac111d6c6. Report an issue: GitHub.